CVE-2025-65212

critical · 9.8

An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification, allowing an attacker to directly request the configuration file address and download the core configuration file without logging into the device management backend. By reading the corresponding username and self-decrypted MD5 password in the core configuration file, the attacker can directly log in to the backend, thereby bypassing the front-end backend login page.

9.8

CVSS

5.2%

EPSS (exploit prob.)

92nd

EPSS percentile

2026-01-06

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-565

Affected products

Vendor	Product	Affected versions
njhyst	hy511_firmware	< 2.1
njhyst	hy511	all versions

Check a specific version with /api/v1/cve/match.

References

https://gist.github.com/a2148001284/bcdda75fc8718454f16a7b9259463719
https://github.com/a2148001284/test1/blob/main/%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E5%90%8E%E5%8F%B0%E6%BC%8F%E6%B4%9EEN.md

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-65212